Dynamic generation of context-sensitive data and instructions for troubleshooting problem events in information network systems

ABSTRACT

A system and method for dynamically providing information to an administrator of a computing environment such as an administrator of a network system that is relevant to a particular problem event. This information includes contextual instructions and diagnostic data that will assist the network administrator in the analysis of the problem event. Generally, the invention automatically obtains from relevant computing environment entities pertinent information likely to be necessary to troubleshoot the particular problem event. The context-sensitive information is presented dynamically on a display for consideration and interaction by the network administrator. Specifically, the invention includes a database of executable troubleshooting (TS) profiles each specifically designed for a particular type of problem event. Each such TS profile references one or more troubleshooting data miner modules included in a library of such modules that accesses particular hardware or software entities in the network system for particular information. When a TS profile is invoked to assist a network administrator troubleshoot a particular type of problem event, the referenced data miner modules are executed and generate or cause the generator of troubleshooting instructions and diagnostic data which is then displayed to the network administrator.

BACKGROUND OF THE INVENTION

[0001] 1. Field of the Invention

[0002] The present invention is directed to computer network systemsand, more particularly, to troubleshooting network systems.

[0003] 2. Related Art

[0004] Computer networks are widely used to provide increased computingpower to facilitate the sharing of resources and to enable communicationto occur between disperse users. Today's computer networks are largecomplex systems with many components from a large variety of vendorsinterconnected to form the network. Networks may include a number ofcomputer devices within a room, a building or a site that areinterconnected by a high speed local data link such as local areanetwork (LAN), token ring, Ethernet or the like. Local networks indifferent locations may be interconnected by techniques such as packetswitching, microwave links and satellite links to form a world-widenetwork such as the Internet. A network system can include severalhundred or more interconnected devices.

[0005] Network management is the common term given to the task ofplanning, engineering, securing and operating a network system. Onenetwork management task is the troubleshooting of faults, errors and thelike (collectively, “problem events”) that occur in entities forming oroperating on a network system. There are many different entities thatneed to be managed in a network. These entities include, for example,routers, bridges, PC's, workstations, minicomputers, supercomputers,printers, file servers, switches, communications systems, databases,software applications and the like. Such hardware and software entitiesare referred to herein simply as “entities” for ease of reference. Asthe types of entities that form or reside on a network system increase,so to does the variety of faults that must be diagnosed and remedied tomaintain such entities operational. The task of troubleshooting anetwork system, therefore, requires greater expertise and becomes moredifficult as the network system becomes larger and more complex.

[0006] Network management systems have been utilized in the past toassist a network administrator/network operator/customer/user/networkmanager (“network administrator” herein) troubleshoot the networksystem. As used herein, the term “troubleshoot” refers to the diagnosticactivities performed to determine one or more correction actionsnecessary or potentially helpful to repair the cause or causes of aproblem event. Typically, there is a management system for differenttypes of entities on the network system. For example, large networksoften include network managers, database managers and softwareapplication managers, to name a few. Due to the diversity of suchmanaged entities, such management systems are commonly referred to asdomain managers. Conventional network management systems typicallyoperated by remote access, monitoring information from the managedentities on the network system. As the problem events occur,conventional network management systems notify the network administratorof the problem events for diagnoses and repair of the cause(s) of theproblem event.

[0007] Unfortunately, conventional network management systems collectlarge volumes of information that must be evaluated by the networkadministrator to diagnose a problem. Oftentimes the informationpresented is not relevant to the diagnosis or correction of the problem.Conventional network management systems, therefore, place a tremendousburden on the network administrator. The network administrator must knowor determine which information is relevant to the particular problem,and must also know or determine the source or sources of such diagnosticinformation as well as the manner in which the diagnostic information isto be retrieved from such source or sources.

[0008] In addition, the network administrator must be well versed in awide variety of types of entities such as network systems, softwareapplications, and the like in order to understand and respond toproblems generated by the various entities on the network system.Oftentimes, the less proficient network administrator is misled by thepresentation of less relevant information. This increases the likelihoodthat the network administrator will take a longer time to diagnose aproblem or incorrectly diagnose the problem due to the inclusion of suchirrelevant information in the evaluation of the problem event.

[0009] What is needed, therefore, is a system, method or technique toassist a network administrator troubleshoot a network system.

SUMMARY OF THE INVENTION

[0010] The present invention is directed to systems and methodologiesfor dynamically providing information to a network administrator that isrelevant to a particular problem event. This information includescontextual instructions and diagnostic data that will assist the networkadministrator in the analysis of the problem event. Generally, theinvention automatically obtains from relevant computing environmententities pertinent information likely to be necessary to troubleshootthe particular problem event. The context-sensitive information ispresented dynamically on a display for consideration and interaction bythe network administrator. Specifically, aspects of the inventioninclude a database of executable troubleshooting (TS) profiles eachspecifically designed for a particular type of problem event. Each suchTS profile references one or more troubleshooting data miner modulesincluded in a library of such modules that accesses particular hardwareand/or software entities in the computing environment for information.When a TS profile is invoked to assist a network administratortroubleshoot a particular type of problem event, the referenced dataminer modules are executed and generate or cause the generation oftroubleshooting instructions and diagnostic data which are thendisplayed to the network administrator.

[0011] Advantageously, this context-sensitive diagnostic data andtroubleshooting instructions serve to guide the network administratorthrough the troubleshooting process for the particular problem event,facilitating the efficient identification and correction of the cause ofthe problem event. This is particularly beneficial in those environmentsin which inexperienced network administrators are responsible fortroubleshooting events.

[0012] Another advantage of the present invention is that the TSprofiles serve as a knowledge base of troubleshooting information andtechniques, systematizing the knowledge of experts through thedevelopment and ongoing modification of such troubleshooting profiles.As new or refined approaches to addressing a particular problem eventare developed, the corresponding TS profile can be modified to referencedifferent or additional data miner modules to generate or cause thegeneration of different or additional diagnostic data or troubleshootinginstructions reflecting the new or refined approach. This provideseffective and efficient solutions for detecting, isolating and repairingproblem events, even by less skilled personnel.

[0013] The invention is also flexible and extendable. It allows for thedevelopment of TS profiles to address a single problem event or a groupof problem events having a common characteristic determined by thedeveloper of the TS profiles. As new entities are added to the computingenvironment a corresponding troubleshooting data miner module can beadded to obtain information therefrom. The invention, therefore, allowsnot only for the improved diagnosis of existing problem events occurringin existing entities, it also allows for new entities, technologies,applications and protocols.

[0014] In addition, automatically providing the network administratorwith troubleshooting data from various entities across the computingenvironment eliminates the need for the network administrator to know ordetermine which information is relevant to the particular problem event.This also relieves the network administrator from knowing or determiningthe source or sources of such information and the manner in which theinformation is to be retrieved from such source entity or entities. Thisis a significant benefit because not all network administrators areknowledgeable about each of the different types of network entities andmanagement systems. Providing the network administrator only withinformation helpful to isolate and correct the cause of a problem eventwhile eliminating from display other, less relevant information preventsthe network administrator from spending time obtaining and reviewinginformation that is unnecessary to be considered in the troubleshootingprocess. This also reduces the likelihood that the network administratorwill incorrectly diagnose the problem event due to the inclusion of suchirrelevant information in the troubleshooting process.

[0015] A number of aspects of the invention are summarized below, alongwith different embodiments of each of the summarized aspects. It shouldbe understood that the embodiments are not necessarily inclusive orexclusive of each other and may be combined in any manner that isnon-conflicting and otherwise possible, whether they be presented inassociation with a same or different aspect of the invention. It shouldalso be understood that these summarized aspects of the invention areexemplary only and are considered to be non-limiting.

[0016] In one aspect of the invention, a troubleshooting mentor systemis disclosed. The troubleshooting mentor system automatically provides anetwork administrator of a computing environment with diagnostic dataand troubleshooting instructions to troubleshoot a selected problemevent occurring in the computing environment. Importantly, thediagnostic data and instructions are specifically designed to providethe information and techniques necessary to enable a networkadministrator troubleshoot the selected problem event. The diagnosticdata is automatically retrieved from relevant computing environmententities upon selection of the problem event, which is one of aplurality of problem events generated by domain managers in thecomputing environment. Each domain manager manages one or more entitieson the computing environment.

[0017] In one embodiment, the troubleshooting mentor system includes aproblem event processor, a troubleshooting profile manager and atroubleshooting portal view manager. Problem events are categorizedaccording to the type of troubleshooting activity that is to beperformed to diagnose the problem event. The problem event processorcauses a display of the problem events that have occurred, anddetermines which troubleshooting type corresponds with the selectedproblem event. The troubleshooting profile manager executes apredetermined troubleshooting profile associated with thattroubleshooting type. The troubleshooting portal view manager executesthe retrieved troubleshooting profile and troubleshooting data minermodules referenced therein. Each troubleshooting data miner modulegenerates or causes the generation of the diagnostic data andinstructions which are subsequently displayed for the networkadministrator.

[0018] In another aspect of the invention, an apparatus that displayscontext-sensitive troubleshooting information relevant to the diagnosisof a particular problem event occurring a computing environment isdisclosed. The troubleshooting information includes instructions fortroubleshooting the particular problem event. The context-sensitivetroubleshooting information is generated automatically and withoutnetwork administrator action subsequent to identifying the particularproblem event. Preferably, the context-sensitive troubleshootinginformation relevant to the particular problem event includes diagnosticdata for assisting a network administrator in the diagnosis of theparticular problem event.

[0019] In one embodiment, the apparatus includes a database oftroubleshooting data miner modules each generating or causing thegeneration of either troubleshooting instructions or diagnostic data.Also included is a repository of troubleshooting profiles eachreferencing one or more data miner modules that result in the generationof troubleshooting instructions and diagnostic data for a particulartype of problem event. A memory device that stores data that associateseach problem event type with a troubleshooting profile is also included.A troubleshooting software module displays problem events received fromdomain managers and determines the type of problem event selected by anadministrator. The software module also retrieves from the repository atroubleshooting profile that is associated with the determined type, andexecutes the retrieved troubleshooting profile. This causes theinvocation of the referenced troubleshooting data miner modules and thedisplay of the diagnostic data and troubleshooting instructionsgenerated by the referenced troubleshooting data miner modules.

[0020] In a still further aspect, a method for displayingcontext-sensitive information relevant to a particular problem eventoccurring in an entity of a computing environment is disclosed. Themethod includes A) receiving a selected problem event; B) generatingcontextual instructions and diagnostic data pertinent to troubleshootingthe particular problem event; and C) displaying the instructions anddiagnostic data on a display device.

[0021] In one embodiment, receiving a selected problem eventcomprises: 1) receiving a plurality of problem events each generated bya domain manager residing in the computing environment; and 2) storingthe received problem events in a repository of problem events that haveoccurred in the computing environment. The method also includes 3)displaying the plurality of stored problem events in an interactivedisplay; 4) receiving a network administrator selection of one of thedisplayed problem events; and 5) generating an output indicating whichof the plurality of problem events is the selected problem event.

[0022] In another embodiment, generating contextual diagnostic datapertinent to troubleshooting the particular problem event includes 1)determining which type of problem event is the selected problem event;and 2) determining which troubleshooting diagnostic data andinstructions to display based on the type of the selected problem event.This latter operation includes a) providing a database oftroubleshooting data miner modules each generating or causing thegeneration of diagnostic data and/or instructions related to aparticular network entity or function. A second operation of b)generating a database of troubleshooting profiles each referencing apredetermined one or more troubleshooting data miner modules to displaydiagnostic data and troubleshooting instructions pertinent to aparticular type of problem event is also included. This operationfurther includes c) retrieving from the database of troubleshootingprofiles a troubleshooting profile associated with the type of theselected problem event; and d) invoking the retrieved troubleshootingprofile and the one or more troubleshooting data miner modulesreferenced therein.

[0023] In a still further aspect of the invention, a method fordisplaying context-sensitive information relevant to a particularproblem event occurring in an entity of a computing environment isdisclosed. The method includes A) displaying a representation of aplurality of problem events that have occurred in computing environment;B) receiving an network administrator selection of one of the displayedproblem event representations; and C) displaying, in response to thenetwork administrator selection, diagnostic data pertinent totroubleshooting the selected problem event and instructions informingthe network administrator how to troubleshoot the selected problemevent. In a particular embodiment, the method also includes D)displaying graphical display elements representing additional, moredetailed information; E) receiving an network administrator graphicalselection of once such graphical display element; and F) displaying theadditional, more detailed information represented by the selecteddisplay element in response to the network administrator graphicalselection.

[0024] In another aspect of the invention, a computer program productcomprising a computer readable medium having computer program logicrecorded thereon for enabling a processor in a computer system toautomatically display diagnostic data and instructions on how totroubleshoot a selected problem event is disclosed. The diagnostic dataand instructions are specifically relevant to troubleshooting theselected problem event.

[0025] In a further aspect of the invention, a program storage devicereadable by a machine, tangibly embodying a program of instructionsexecutable by the machine to perform method steps for displayingcontext-sensitive information relevant to a particular problem eventoccurring in an entity of a computing environment is disclosed. Themethod includes A) receiving a selected problem event; B) generatingcontextual instructions and diagnostic data pertinent to troubleshootingthe particular problem event; and C) displaying the instructions and thediagnostic data on a display device.

[0026] Various embodiments of the present invention provide certainadvantages and overcome certain drawbacks of the conventionaltechniques. Not all embodiments of the invention share the sameadvantages and those that do may not share them under all circumstances.Further features and advantages of the present invention as well as thestructure and operation of various embodiments of the present inventionare described in detail below with reference to the accompanyingdrawings. In the drawings, like reference numerals indicate identical orfunctionally similar elements. Additionally, the left-most one or twodigits of a reference numeral identifies the drawing in which thereference numeral first appears.

BRIEF DESCRIPTION OF THE DRAWINGS

[0027] The present invention is pointed out with particularity in theappended claims. The above and further advantages of this invention maybe better understood by referring to the following description taken inconjunction with the accompanying drawings, in which:

[0028]FIG. 1 is a block diagram of an exemplary network suitable forimplementing the troubleshooting system of the present invention.

[0029]FIG. 2 is a schematic block diagram of the primary components of atroubleshooting mentor in accordance with one embodiment of the presentinvention.

[0030]FIG. 3 is a functional block diagram of a problem event processorin accordance with one embodiment of the present invention.

[0031]FIG. 4 is a functional block diagram of one embodiment oftroubleshooting profile manager of the present invention.

[0032]FIG. 5 is a block diagram illustrating the contents of a TSprofile in accordance with one embodiment of the present invention.

[0033]FIG. 6 is a functional block diagram of one embodiment oftroubleshooting portal view manager of the present invention.

[0034]FIG. 7 is a high-level flow chart of the operations performed bytroubleshooting mentor in accordance with one embodiment of the presentinvention.

[0035]FIG. 8 is a more detailed flow chart of the processes performed bytroubleshooting mentor in accordance with one embodiment of the presentinvention.

[0036]FIG. 9 is a more detailed flow chart of the processes performed bytroubleshooting mentor in accordance with one embodiment of the presentinvention.

[0037]FIG. 10 is a flow chart illustrating the user interface displayoperations in one embodiment of the present invention.

[0038]FIG. 11 is an illustration of a graphical user interface displaywindow showing an example of a problem event list generated by thetroubleshooting mentor of the present invention.

[0039]FIG. 12 is an illustration of the relationship between FIGS.12A-12F.

[0040] FIGS. 12A-12F together illustrate another example of a TS profileof the present invention.

[0041] FIGS. 13A-13C together illustrate a troubleshooting view windowdisplayed in response to the execution of the TS profile illustrated inFIGS. 12A-12F in accordance with one embodiment of the presentinvention.

[0042]FIG. 14 is an illustration of a graphical user interface displaywindow showing another example of a problem event list generated by thetroubleshooting mentor of the present invention.

[0043]FIG. 15 is an illustration of the relationship between FIGS.15A-15F.

[0044] FIGS. 15A-15F together illustrate another example of a TS profileof the present invention.

[0045] FIGS. 16A-16E together illustrate a troubleshooting view windowdisplayed in response to the execution of the TS profile illustrated inFIGS. 15A-15F in accordance with one embodiment of the presentinvention.

DETAILED DESCRIPTION I. Introduction A. High-Level Description

[0046] The present invention is directed to systems and methodologiesfor dynamically providing information to a network administrator that isrelevant to a particular problem event. This information includescontextual instructions and diagnostic data that will assist the networkadministrator in the analysis of the problem event. Generally, theinvention automatically obtains from relevant network system entitiespertinent information likely to be necessary to troubleshoot theparticular problem event. The context-sensitive information is presenteddynamically on a display for consideration and interaction by thenetwork administrator. Specifically, aspects of the invention include adatabase of executable troubleshooting (TS) profiles each specificallydesigned for a particular type of problem event. Each such TS profilereferences one or more troubleshooting data miner modules included in alibrary of such modules that accesses particular hardware and/orsoftware entities in the network system for particular information. Whena TS profile is invoked to assist a network administrator troubleshoot aparticular type of problem event, the referenced data miner modules areexecuted and generate or cause the generation of troubleshootinginstructions and diagnostic data which are then displayed to the networkadministrator.

[0047] Advantageously, this context-sensitive diagnostic data andtroubleshooting instructions serve to guide the network administratorthrough the troubleshooting process for the particular problem event,facilitating the efficient identification and correction of the cause ofthe problem event. This is particularly beneficial in those environmentsin which inexperienced network administrators are responsible fortroubleshooting events.

[0048] Another advantage of the present invention is that the TSprofiles serve as a knowledge base of troubleshooting information andtechniques, systematizing the knowledge of experts through thedevelopment and ongoing modification of such troubleshooting profiles.As new or refined approaches to addressing a particular problem eventare developed, the corresponding TS profile can be modified to referencedifferent or additional data miner modules to generate or cause thegeneration of different or additional diagnostic data or troubleshootinginstructions reflecting the new or refined approach. This provideseffective and efficient solutions for detecting, isolating and repairingproblem events, even by less skilled personnel.

[0049] The invention is also flexible and extendable. It allows for thedevelopment of TS profiles to address a single problem event or a groupof problem events having a common characteristic determined by thedeveloper of the TS profiles. As new entities are added to the networksystem a corresponding troubleshooting data miner module can be added toobtain information therefrom. The invention, therefore, allows not onlyfor the improved diagnosis of existing problem events occurring inexisting entities, it also allows for new entities, technologies,applications and protocols.

[0050] In addition, automatically providing the network administratorwith troubleshooting data from various entities across the networksystem eliminates the need for the network administrator to know ordetermine which information is relevant to the particular problem event.This also relieves the network administrator from knowing or determiningthe source or sources of such information and the manner in which theinformation is to be retrieved from such source entity or entities. Thisis a significant benefit because not all network administrators areknowledgeable about each of the different types of network entities andmanagement systems. Providing the network administrator only withinformation helpful to isolate and correct the cause of a problem eventwhile eliminating from display other, less relevant information preventsthe network administrator from spending time obtaining and reviewinginformation that is unnecessary to be considered in the troubleshootingprocess. This also reduces the likelihood that the network administratorwill incorrectly diagnose the problem event due to the inclusion of suchirrelevant information in the troubleshooting process.

B. Exemplary Network Application

[0051] For simplicity and illustrative purposes, the principles of thepresent invention are described with reference to an exemplary networkapplication of a service information portal. However, one of ordinaryskill in the art would readily recognize from the present disclosurethat the present invention can be implemented in any network node in anynetwork environment, and is applicable to all types of networkmanagement systems.

[0052] As used herein, the term “computing environment” refers tovirtually any local or distributed system, processing platform orstructure. One common computing environment in which troubleshootingoperations are performed is a network system. FIG. 1 is a block diagramof an exemplary network system 100 in which the troubleshooting mentorof the present invention is implemented. Network 100 includes individualcomputing platforms generally referred to as network nodes. Networknodes include but are not limited to workstations, personal computers,thin clients, file servers, computer servers and host computers. Ingeneral, network elements are anything that participates in the serviceof providing for the generation and transfer of data and resources innetwork system 100. Network elements include, for example, LANs,routers, bridges, gateways, multiplexers, switches, connectors and thelike. These network devices are considered to be well-known in the artand are not described further herein.

[0053] Network system 100 includes a backbone 110 formed of numerousnetwork devices to which is connected customer nodes 120 and a serviceinformation portal (SIP) 130. Network system 100 may be implemented as alocal area network, wide area network, wireless network, the Internet orthe like. In this exemplary embodiment, network system 100 utilizes ahypertext transfer protocol (HTTP) to provide communication servicesbetween web browsers 122 residing on customer nodes 120 and a web server132 on service information portal 130. Web browsers 122 can be, forexample, the NAVIGATOR from the Netscape Communications Corporation ofMountain View, Calif., USA, or the INTERNET EXPLORER from the MicrosoftCorporation of Redmond, Wash., USA, among others. It should beunderstood that any one of a variety of other network protocols such asTCP/IP, X.25, and others can also be used to provide such communicationservices.

[0054] A service information portal 130 managed by a service providerprovides a variety of network services to customers 120. The networkservices may include Internet services, electronic mail (e-mail)services, data storage, network management services and the like. Acustomer may not prefer to create and/or manage a network to providenetwork services. Oftentimes, such decisions are driven by a lack ofexpertise, cost, etc. In order to receive network services, a customermay utilize a service provider to provide for the desired networkservices. The service provider configures a portion of network 100 intopartitioned networks 142 and allocates each partitioned network to aparticular customer 120.

[0055] A management information portal 134 may be configured to providecustomized management services to customers 120 by referencing acustomer views module 136. The customer views module 136 may beconfigured to maintain a database of the types of services available toeach customer in response to being authenticated by the serviceinformation portal 130. The management information portal 134 may befurther configured to interface with a network management system (“NMS”)138. NMS 138 may be configured to provide network management servicessuch as network configuration and control, monitoring, evaluation andmaintenance, and the like, to the management information portal 134 fornetwork 110. In accordance with aspects of the present invention,network management system 138 includes a troubleshooting mentor 126 ofthe present invention.

[0056] Service information portal 130 communicates with entities innetwork partitions 140 through a management station (MS) 144. Managementstations 144 may be configured to provide a management node function foreach of the partitioned networks 142. Existing network managementprotocols include Simple Network Management Protocol (SNMP), InternetControl Message Protocol (ICMP) and many proprietary network managementprotocols. Service information portal 130 communicates with managementstations 144 using one of these or another protocol.

[0057] Troubleshooting mentor 126 is, as noted, included in networkmanagement node 118 in this illustrative application of the invention.Troubleshooting mentor 126 is a software tool that dynamically providesto the network administrator contextual instructions and diagnostic datathat are relevant to troubleshooting a particular problem event.Troubleshooting mentor 126 automatically obtains from relevant networksystem entities pertinent information likely to be helpful to diagnosethe cause of the particular problem event. The context-sensitiveinformation is presented dynamically on a user interface 128 forconsideration and interaction by the network administrator. The userinterface 128 can include a video display screen keyboard, mouse,printer, etc., and provides all types of interactions with a networkadministrator. The user interface 128 controls the screen, keyboard,mouse and pointer and provides the user with a view of network system100 that is being managed. User interface 128 receives information fromthe troubleshooting mentor 126 in accordance with the present inventionas described below.

II. Troubleshooting Mentor 126 A. Introduction

[0058]FIG. 2 is a schematic block diagram of the primary components of atroubleshooting mentor 126 in accordance with one embodiment of thepresent invention. Troubleshooting mentor 126 is represented by thedashed box illustrated in FIG. 2, and includes a number of primarycomponents shown located therein.

[0059] Network system 100 includes various management systems thatgenerate problem events. Such management systems generally includehistorical and real-time data regarding the health of the managednetwork entity. Such management systems are accessed for troubleshootinginformation in accordance with aspects of the present invention. Forexample, network manager 214 are software products that manageindividual networks as well as large collections of networks. Anexemplary network manager is the Open View® Network Node Manageravailable from Hewlett-Packard Company, Palo Alto, Calif., USA.(OPENVIEW is a registered trademark of Hewlett-Packard Company.)

[0060] Application managers 216 are software products that manage thesoftware applications executing on a particular node or server ofnetwork 100. Examples of commercially available application managers arethe Patrol® available from BMC Software, Inc., Houston, Tex., USA. andthe Open View® SPI, available from Hewlett-Packard Company, Palo Alto,Calif., USA. (PATROL is a registered trademark of BMC software, Inc.)System managers 218 can be any management tool that manages theinfrastructure of the particular network or components of network system100. Examples of system managers 218 include the Open View®VantagePoint™ available from Hewlett-Packard Company, Palo Alto, Calif.,USA. (VantagePoint is a trademark of Hewlett-Packard Company.)

[0061] Database managers 220 are software products that manage large,complex databases that are accessible to many users across networksystem 100. Examples include any of the Portal® database managerproducts available from BMC Software, Inc. Server managers 222 aresoftware products that assist a network administrator manage theoperations of each server in a network. Examples include any of thePortal® server manager products available from BMC Software, Inc., andthe Open View® VantagePoint Operations available from Hewlett-PackardCompany.

[0062] As noted, these management systems are generally and collectivelyreferred to herein as domain managers 224. The term “domain” reflectsthe variety of hardware and software that is being managed by each ofthe managers 214, 216, 218, 220 and 222. That is, for each aspect or“domain” of network system 100, there are one or more management systemsconfigured to manage that particular aspect or domain of components,systems, devices, software, etc. It should be understood that this listof domain managers 224 is exemplary only, and that troubleshootingmentor 126 of the present invention can operate with other domainmanagers 224 now or later developed.

[0063] Domain managers 224 provide an indication of an occurrence thatrequires or may require the attention of the network administrator.Domain managers 224 typically include software and systems that monitorthe operations of the managed objects. This monitoring software detectsfaults, errors and other conditions (as noted, “problem events”) in themanaged objects and generated a signal 201 indicating the nature anddetails of such an occurrence. As used herein, the term “problem event”also refers to the generation of any indication of the above or anyother condition that warrants the attention of a network administrator.Thus, signal 201 is referred to herein as problem event signal 201 or,simply, problem event 201. In addition to the above and otherautomatically-generated indications, the term “problem event” alsoincludes indications that are entered manually into troubleshootingmentor 126. For example, the network administrator may witness a problemor a customer of the network may call or email the network administratorwith an indication of a problem condition. In response to suchoccurrences, the network administrator enters the event information intotroubleshooting mentor 126 as described below. Such an entry is referredto herein as a problem event.

[0064] Problem event processor 202 receives problem events 201A as wellas manual problem events 201B (collectively and generally referred to asproblem events 201). Event processor 202 consolidates the receivedevents 201, 211. That is, event processor 202 includes the functionalityto interface with different domain managers 224, and interpret and storerepresentations of problem events 201 in a memory device. This problemevent list 213 is provided to a problem event graphical user interface(GUI) 210 for ultimate display to the network administrator. Thus,problem event processor 202 can provide the network administrator with aview of the problem events 201 that have occurred in network system 100.Examples of two such event list display windows are described below withreference to FIGS. 11 and 14.

[0065] The network administrator can graphically select which of theproblem events 201 displayed in the event list display window totroubleshoot at any given time. The network administrator makes such aselection through problem event GUI 210, resulting in the generation ofproblem event selection 215. Event processor 202 selects and generatescertain data 203 associated with selected event 215. Problem events 201fall into a number of different types or categories. Event data 203includes an indication of the type of problem event 201.

[0066] A troubleshooting profile manager 204 receives event data 203generated by problem event processor 202. Event data 203 providesdetails about the selected problem event 215. Based on the type ofproblem event, profile manager 204 determines which of a plurality oftroubleshooting (TS) profiles 205 is to be implemented to assist thenetwork administrator diagnose and correct the cause or causes of theproblem event. Each such TS profile 205 is associated with a particulartype of problem event, and references troubleshooting data miner modulesthat accesses particular hardware or software entities in the networkfor information specific for troubleshooting the associated type ofproblem event.

[0067] A troubleshooting portal view manager 206 invokes the TS profile205, retrieving TS data 207 from domain managers 224 and TS instructions209 from an instruction database 208 that are referenced in theimplemented TS profile 205. This event-type-specific information isdisplayed through troubleshooting GUI 212 in accordance with TS profile205, along with any other information contained within TS profile 205.TS profile 205 is designed to provide information to enable the networkadministrator to address the specific type of problem event 215.Accordingly, the retrieved TS data 207 and TS instructions 209 areparticularly relevant to troubleshooting the selected problem event 215.This information is provided to troubleshooting GUI 212 for display inaccordance with viewpoint layout information 223 provided by portal viewmanager 206.

[0068] Should information other than that provided by portal viewmanager 206 be desired by the network administrator to troubleshootselected problem event 215, the network administrator can enter acommand 221 requesting that different TS data 207 be obtained.Troubleshooting portal view manager 206 accesses domain managers 224 asnecessary to obtain or cause the generation of the requested TS data207.

B. Detailed Description

[0069] Each of the introduced elements of troubleshooting mentor 126will now be described. As described above and illustrated in FIG. 2,troubleshooting mentor 126 primarily includes problem event processor202, troubleshooting profile manager 204, troubleshooting portal viewmanager 206 and the associated GUIs 210 and 212. Problem event processor202 will be described with reference to FIG. 3, troubleshooting profilemanager 204 will be described with referenced to FIGS. 4 and 5, andtroubleshooting portal view manager 206 will be described with referenceto FIG. 6. The graphical user interfaces 210 and 212 are conventionalentities that display problem event list 213 or TS data and instructions207, 209 in response to the other components of troubleshooting mentor126. After the functions of each such component of troubleshootingmentor 126 is described, the flow of operations performed bytroubleshooting mentor 126 will then be described with referenced toFIGS. 7-10.

1. Problem Event Processor 202

[0070] Problem event processor 202, as noted, provides the networkadministrator with a view of problem events 201 which have occurred innetwork system 100, and provides event data 203 associated with aselected one of such problem events 215. FIG. 3 is a functional blockdiagram of problem event processor 202 in accordance with one embodimentof the present invention. Problem event processor 202 includes an eventconsolidator 302 and an event type determinator 304. Each of thesecomponents is described in detail below.

[0071] Generally, event consolidator 302 receives problem events 201from domain managers 224. Problem events 201 that are generated bydifferent domain managers 224 have different information, differentformats and the like. Event consolidator 302 processes this wide varietyof problem events 201 and generates a standard format event identifier,referred to herein as a normalized event identifier (ID) 301. Thisnormalized event identifier 301 includes the same information as problemevent 201 from which it is derived, but is in a format recognizable bythe second primary component of event processor 202, event typedeterminator 304.

[0072] Event consolidator 302 displays a list 213 of problem events 213through problem event GUI 210. The network administrator, upon viewingproblem event list 213, selects one of the presented events fortroubleshooting. Such a selection can be made through any graphical oruser interface device. This selection is represented by problem eventselection 215.

[0073] Event consolidator 302 not only generates normalized event ID301, but also generates other information related to problem event 201.This other information is utilized by other components oftroubleshooting mentor 126 other than event type determinator 304. Thisother information generated by event consolidator 302 includes theoriginal event ID 303 for use by TS profile manager 204. Eventconsolidator 302 can be any well-known event consolidator now or laterdeveloped such as the Open View® Vantage Point Operations productavailable from Hewlett-Packard Company, and the Netcool eventconsolidator available from Micromuse. Event consolidator 302 isconsidered to be well known in the art and is not described furtherherein.

[0074] Event type determinator 304 receives normalized event identifier301. In accordance with the disclosed embodiment, normalized event ID301 is presented in a predetermined format and includes information suchas a timestamp, source machine, description field, management system,for one example.

[0075] In accordance with aspects of the present invention, all problemevents 201 are operationally categorized in accordance with the type oftroubleshooting information and activities that may be required to beperformed or analyzed in order to successfully troubleshoot selectedproblem event 215. Event type determinator 304 generates an event TStype 305 indicating the troubleshooting category that selected problemevent 215 falls into.

[0076] In addition, event type determinator 304 generates eventspecifics 305. Event specifics 307 includes such information as theidentification of the managed object, such as a network node identifier,software application instance identifier or the like. Event specifics307 also includes location in network 100 at which the event occurred,and other information related to the occurrence of selected problemevent 215.

[0077] In an alternative embodiment, event consolidator 302 generates anormalized event ID 301 that includes a field that identifies the typeof problem event 201. In such embodiments, problem event processor 202need not include a separate element that determines the event TS typesuch as event type determinator 304. Instead, TS profile manager 204,described next below, utilizes the event type provided directly by eventconsolidator 302 in such embodiments.

[0078] The event identification 301, original event ID 303, eventspecifics 307 and event TS type 305 are collectively referred to asevent data 203. As noted, event data 203 is provided to TS profilemanager 204, described next below.

2. TS Profile Manager 204

[0079]FIG. 4 is a functional block diagram of one embodiment oftroubleshooting profile manager 204 of the present invention. Includedin troubleshooting profile manager 204 is a database 408 oftroubleshooting profiles 403. As will be described in detail below,troubleshooting profiles 403 are generated and stored in database 408 apriori. A TS profile selector 402 receives event TS type 305 and selectsone TS profile 403 appropriate for diagnosing the original selectedevent 215. TS profile 205 is an extensible, executable software programthat invokes a predetermined combination of troubleshooting data minermodules (described below) that generate or cause the generation ofcontext-sensitive troubleshooting data and instructions to assist thenetwork administrator determine the cause or causes of selected problemevent 215.

[0080] As noted with reference to problem event processor 202, event TStype 305 represents a type of event. There may be many such event typessome of which can be supported by the same TS profile 403. Therelationship between event TS type 305 and TS profile 403 could beunknown (new events can be generated as network system 100 expands orchanges). In addition, the number of event TS types can be greater thanthe number of TS profiles 403. Because of such circumstances, TS profileselector 402 may be required, in certain embodiments, to perform someprocessing to map a TS profile 403 to an event type 305 of selectedproblem event 215.

[0081] As noted, the selection of which TS profile 403 is to be used toassist the network administrator in the diagnosis of problem event 215is based on the context of the event. This context is provided by eventTS type 305. In one embodiment disclosed in FIG. 4, TS profile selector402 interfaces with a mapping look-up table (LUT) 406 that includesmappings between event TS type 304 and TS profile identifiers (IDs) 401.TS profile selector 402 accesses LUT 406 with event TS type 305 andretrieves an associated TS profile ID 401. This mapping LUT 406 providestroubleshooting profile manager 204 with the capability of changing,adding and otherwise editing the mappings as information about thetroubleshooting process in learned.

[0082] The use of a LUT 406 to provide the mappings is advantageous inthose environments in which the mappings may change over time since LUTscan be easily populated with new data. In addition, implementing suchfunctionality in a LUT allows for efficient processing. For example, inone embodiment, wildcard matching is implemented to avoid having toenumerate each and every event TS type 305. In addition, an ID for adefault TS profile can be included in mapping LUT 406 for thosecircumstances when there is no entry in mapping LUT 406 for the receivedevent TS type 305. As one of ordinary skill in the art would findapparent, other functions and operations associated with the use of aLUT-based mapping scheme can be implemented in TS profile selector 402.Such modifications are considered to be within the scope of the presentinvention. Thus, upon receipt of event TS type 305, TS profile selector402 accesses LUT 406 and retrieves TS profile 401. TS profile selector401 then accesses database 408 and retrieves the identified TS profile403.

[0083] As shown in FIG. 4, a TS profile editor 410 is also included introubleshooting profile manager 204. TS profile editor 410 enables annetwork administrator to modify, add or delete the contents of mappingLUT 406 and TS profile database 408. Thus, as problem events 201 change,such as in response to the addition to domain managers 224, or asadditional TS profiles 403 are generated, database 408 can be easilymodified, and, if necessary, LUT 406 can be edited to reflect suchchanges in database 408.

[0084] A TS profile 403 is an executable, extensible file that, wheninvoked, obtains or generates instructions and data for correcting theparticular event 201. FIG. 5 is a block diagram illustrating thecontents of a TS profile 205. As will be described below, TS profile 403retrieved from database 408 which is populated by a TS profileconditioner 404. FIG. 5 illustrates a populated TS profile 205.

[0085] TS profile 205 includes portal view layout information 502 foruse by troubleshooting portal view manager 206 and troubleshooting GUI212 in the generation of a TS view window (described below). Such atroubleshooting view window includes contextual instructions 209 andrelevant troubleshooting data 207, introduced above. Instructions 209and troubleshooting data 207 are obtained by troubleshooting data minermodules or, simply, data miners (also described below) invoked by TSprofile 205. TS profile 205 includes references 504 to a predeterminedcombination of data miners that are to be utilized to obtaintroubleshooting information relevant to the diagnosis of selectedproblem event 215. In addition, TS profile 205 also includes data minerconfiguration information 506. Such information is included in parametervalues that provide requisite information such as the problem event,managed object and domain manager, specify the type and breadth ofinformation requested, the manner in which information is to beanalyzed, displayed, etc. Detailed examples of TS profile 205 are setforth below.

[0086] As noted, TS profile 403 is populated by TS profile conditioner404. Original event ID 303 and one or more event specifics 307 are addedto TS profile 403 depending on which TS profile 403 is retrieved andwhich data miners are referenced therein. The results of thisconditioning is populated TS profile 205 which can be executed by portalview manager 206.

[0087] It should be noted that certain default configuration data 506can be included in TS profile 403. Such default information ismodifiable by the network administrator as described elsewhere herein.

3. TS Portal View Manager 206

[0088]FIG. 6 is a functional block diagram of one embodiment oftroubleshooting portal view manager 206 of the present invention. Asnoted, troubleshooting portal view manager 206 retrieves TS data 207 andinstructions 209 and displays the retrieved information throughtroubleshooting GUI 212 in accordance with TS profile 205, along withany other information contained within TS profile 205. TS profile 205 isassociated with the type of selected problem event 215. Accordingly, theretrieved data 207 and instructions 209 are particularly relevant totroubleshooting that event 215. Portal view manager 206 includes adatabase 606 of troubleshooting data miner modules 608 each of whichobtains, generates or causes the generation of specific TS data 207and/or TS instructions 209.

[0089] A data miner manager 602 manages database 606 of data miners,loading and invoking TS data miner modules 608 that are referenced inpopulated TS profile 205. As will be described below, TS data minermodules 608 are typically software programs that, when executed, access,call, query, or otherwise interface with external entities to retrieveor cause the generation of TS data 207 and TS instructions 209. A TSportal view window generator 604 causes troubleshooting GUI 212 todisplay TS data and instructions 207, 209 generated by TS data minermodules 608 in accordance with portal view layout information containedwithin populated TS profile 205. Each of these components is describedin detail below.

[0090] TS data miner modules 608 obtain, generate or cause thegeneration of specific information. TS modules 608 are typicallyexecutable software modules. The term “data miner” as used herein refersto all types of software modules that gather or cause the generation ofdata related to the troubleshooting process. For example, TS data minermodules 608 include software modules that mine data from the database ofone or more domain managers 224. In addition, TS data miner modules 608can include software programs that access knowledge databases providedby a customer of network system 100 such as instruction database 208.Instruction database 208 includes, as noted, instructions generated by,for example, a customer to provide specific or detailed instructionsregarding how to address particular problem events. In addition, TS dataminer modules 608 refers to software programs that call or invoke systemutilities and tools that, when executed, generate TS data 207. Thus, TSdata miner modules 608, as used herein, refers to virtually anymechanism that results on the generation of TS data 207, whetherdirectly, such as through the accessing of a database, or indirectly,such as through the generation of a command that causes another softwareprogram to generate TS data 207 or TS instructions 209.

[0091] To illustrate some exemplary external sources of TS data 207 andTS instructions 209, data miners 608 illustrated in FIG. 6 share aninterface with four exemplary external sources. A primary source of TSdata 207 are domain managers 224. Domain managers 224 maintainsignificant amounts of information pertaining to the entities theymanage; that is, the managed objects. Not only is historical informationavailable, but contemporaneous information can also be generated bycertain domain managers 224 when requested to do so. Many domainmanagers 224 offer report generation functions which can be invoked by adata miner 608 to obtain, for example, the noted historical information.The type and scope of the information provided by domain managers 224can generally be specified by the requesting entity.

[0092] Customer databases 608 are external sources of informationprovided by the customer or the customer's systems that containinformation that is desirable to access during a troubleshootingprocess. For example, in one embodiment, customer databases 608 includesa data repository of troubleshooting information generated bytroubleshooting tools not shown in the figures.

[0093] Instruction databases 208 are repositories of TS instructions209. As noted, one of the significant benefits of the present inventionis to provide the network administrator with contextual instructionsthat assist the network administrator through a troubleshooting process.These instructions can be as detailed as desired and can be targeted tonetwork administrators having any level of expertise. As noted, networksystem 100 can include systems or devices that are unique to aparticular customer. As one of ordinary skill in the art would findapparent, TS instructions 209 can be presented to the networkadministrator in virtually any form. For example, text, graphicalelements, examples, etc., may be presented. Different levels ofinformation, selectable by the network administrator, can be provided.HTTP links can be used to allow novice users drill down to more specificinstructions that may not otherwise be useful to a more experiencednetwork administrator. Links to video clips, manuals and the like canalso be provided. Such TS instructions 209 can be included in TS profile403. However, in certain embodiments, it is preferable that such TSinstructions 209 be included in one or more accessible databases 208. Inaddition, data miners 608 can invoke system utilities and tools 610.Such utilities and tools include programs that generate diagnostic orstatus information, and can reside in any number of devices in networksystem 100. There are numerous TS data miner modules 608 that can beutilized or created to generate TS data 207 and TS instructions 209 inaccordance with the present invention. A number of examples are setforth below.

[0094] When a problem event 201 occurs, there may be services that areadversely impacted by that occurrence. An impacted services TS dataminer module 608 accesses databases in, for example, domain managers224, that contain mappings of infrastructure devices to high-levelbusiness services. The services impacted by the problem event 201 canthen be provided to the network administrator for diagnosis and forconsideration in taking corrective or mitigating actions. For example,when a problem event 201 indicates that there is a low-level problemsuch as a server that has gone off line, impacted services TS data minermodule 608 will show the network administrator which services areaffected by the server going down. The result of this inquiry canreveal, for example, the e-mail service that resides on the failedserver. Similarly, if a problem event 201 indicates that a router wentoff-line, the impacted services TS data miner module 608 may determinethat a customer's billing application software cannot be accessed.

[0095] When a problem event 201 occurs, there may be customers that areadversely impacted by that occurrence. An impacted customer TS dataminer module 608 accesses databases in, for example, domain managers224, that contain mappings of infrastructure devices to customers. Thecustomers impacted by the problem event can be categorized. For example,if the customers are departments of an organization, manufacturing maybe considered more critical than maintenance. This information isprovided to the network administrator for diagnosis and forconsideration in taking corrective or mitigating actions. For example,in the above example in which a problem event 201 indicates that aserver that has gone off line, impacted customers TS data miner module608 will show the network administrator which customers utilized thatserver and, therefore will be with a degraded or inoperable e-mailservice.

[0096] As noted, each problem event 201 indicates the managed objectthat caused the generation of the problem event 201. An event details TSdata miner module 608 queries domain manager 224 of the managed objectto obtain additional information regarding the problem event 201. Forexample, if the managed object is a network node, the type of device,the type of problem, when the problem occurred, which portion of themanaged object experienced the problem, and related information may beretrieved to assist the network administrator.

[0097] As noted, contextual instructions 217 are provided to the networkadministrator for assisting in the diagnosis and correction of a problemevent. Such instructions can be stored as part of TS profile 403, orthey may be stored separately in an instruction database 208. In thelatter embodiment, an event instructions TS data miner module 608retrieves the relevant instructions from the database 208. Such aninstruction database can be provided by the customer of the networkspecifying customer-specific solutions to the network administrator.

[0098] Another type of TS data miner module 608 accesses problem eventprocessor 202 or domain managers 224 to retrieve additional problemevents having some specified relationship with the current problemevent. Such a relationship can be in time, location of occurrence, typeof event, etc. For example, if an email system fails, an associatedproblem event report for the same device may indicate that the diskspace on the server is low. The network administrator can then determinewhether the correlation is a reflection of a causation.

[0099] TS data miner modules 608 can also automatically executesutilities or tools in system 100. For example, tools such as ping(“ping”), trace router (“traceroute”) and disk utilization (“du”) areavailable on servers of network system 100. TS data miner modules 608run specified utilities and tools automatically, storing the results ofthose operations in a file.

[0100] Other data miners cause the generation of relevant reports. Manydomain managers generate reports such as reports providing informationregarding network utilization, CPU utilization, etc. For example, if aproblem event occurs in an email server, a data miner may request thatthe domain manager 224 of that node generate a report that identifiesthe number of emails produced per minute in the time vicinity of theproblem event occurrence. In another example in which there is a networkoutage, a report can be generated that shows the SNMP interface errorsthat occurred in the hours before the failure.

[0101] Another type of TS data miner module 608 generates an overallgraphic such as a gauge, bar graph or the like indicating the overallhealth or topology of the network, as reflected by specifiedcharacteristics. Generally, health indicators provide a view of thecurrent state of the specified system, whereas reports providehistorical information. For example, if an email server fails, a healthindicator reflecting the health of the other email systems. In anotherexample, when a network fails, a health indicator of the surroundingnetwork nodes may be desired. Generally, the data miner accesses thedomain managers responsible for the nodes of interest to obtain suchinformation. One suitable troubleshooting data miner module 608 fordisplaying the topology of a partition 142 of network system 100 isdisclosed in U.S. Patent Application entitled “SYSTEM FOR DISPLAYINGTOPOLOGY MAP INFORMATION THROUGH THE WEB,” filed on Apr. 30, 2001 underAttorney Docket No. 10006654-1, the disclosure of which is herebyincorporated by reference herein in its entirety. One suitabletroubleshooting data miner module 608 for displaying the health of anentity in network system 100 is disclosed in U.S. Patent Applicationentitled “METHOD AND APPARAUTS FOR CUTOMIZABLY CALCULATING ANDDISPLAYING HEALTH OF A COMPUTER NETWORK,” filed on Jan. 17, 2001 underAttorney Docket No. 10006622-1, the disclosure of which is herebyincorporated by reference herein in its entirety.

[0102] As one of ordinary skill in the art would find apparent,additional data miners can be added to database 606 that perform otherfunctions that result in the generation of TS data 207 and/or TSinstructions 209. Importantly, this extensibility is beneficial in thatnew domains can be added to network system 100, such as wireless phonesystem, the associated domain manager 224 can be included in theperformance of this manager, data miner will include data miners to minethat new domain.

[0103] A TS module manager 602 manages database 606 of data miners,loading and invoking data miners 608 that are referenced in references504 in populated TS profile 205. Executing data miners 608 access, call,query, or otherwise interface with external sources such as those notedabove to retrieve or cause the generation of TS instructions 207 and TSinstructions 209.

[0104] A TS portal view window generator 604 displays TS data 207 and TSinstructions 209 generated by TS data miner modules 608 in accordancewith portal view layout information 502 contained within populated TSprofile 205. TS data 207 and TS instructions 209 are presented bytroubleshooting GUI 212 as relevant TS data 219 and contextual TSinstructions 217. View port layout commands 223 generated by portal viewmanager 206 instruct troubleshooting GUI 212 how to arrange and displaycontextual instructions and data 217, 219. Some of the displayedinformation can be modified by the network administrator, for example,to modify the type or scope of TS data 219. This command 221 is providedto data miner manager 602, which in turn invokes the relevant data miner608 with modified parameters. The resulting TS data 207 and/or TSinstructions 209 are provided to portal view window generator 604 fordisplay as noted above.

III. Operations

[0105]FIG. 7 is a high-level flow chart of the operations performed bytroubleshooting mentor 126 in accordance with one embodiment of thepresent invention. At block 702 a problem event is received. Contextualinstructions pertinent to troubleshooting the type of problem eventreceived are generated at block 704. In addition, contextual diagnosticdata pertinent to the type of problem event are generated at block 704.These instructions and diagnostic data are displayed to the networkadministrator on a display device for network administrator viewing and,in some embodiments, interaction, at block 706.

[0106]FIG. 8 is a more detailed flow charts of the processes performedby troubleshooting mentor 126 at block 702 in accordance with oneembodiment of the present invention. At block 802, a problem event 201generated by a domain manager 224 is received. The received problemevent 201 is stored in a repository of problem events that haveoccurred. This repository of problem events 201 can be viewed by thenetwork administrator. The network administrator selects one of thestored problem events 201 to troubleshoot. This selection is received atblock 806.

[0107] The type of the problem event selected by the networkadministrator is determined at block 808. This type determinationprovides troubleshooting mentor 126 with an indication of the type oftroubleshooting diagnostic information and instructions to provide thenetwork administrator.

[0108]FIG. 9 is a flowchart of the operations performed at block 704 inaccordance with one embodiment of the present invention. At block 902, adatabase 606 of troubleshooting data miner modules 608 is provided. Suchtroubleshooting data miner modules 608 include any executable softwaremodule that retrieves or causes the generator of diagnostic data. Asnoted, diagnostic data includes any historical or contemporaneousinformation helpful to the evaluation and analysis of problem events201.

[0109] At block 904 a database 408 of TS profiles 403 is generated. Eachsuch TS profile 403 is an executable module designed to invoke certaintroubleshooting data miner modules 608. Each such troubleshooting module608 generates or causes the generation of diagnostic data pertinent totroubleshooting a particular problem event 201.

[0110] At block 906 the problem event selected by the networkadministrator to troubleshoot, followed by block 908 during which a TSprofile 403 corresponding to a selected problem event 201 is retrievedfrom database 408 and populated with information pertaining to theselected problem event.

[0111] Once executed, at block 910 the invoked TS profile 403 calls oneor more TS data miner modules 608 referenced in the executed TS profile403 to generate or cause the generation of TS instructions and TSdiagnostic data.

[0112]FIG. 10 is a flow chart illustrating the user interface displayoperations in one embodiment of the present invention. At block 1002, arepresentation of a plurality of problem events that have occurred innetwork system 100 is displayed. This representation can take on anyform, such as graphical or textual identifiers, associated descriptions,and the like.

[0113] At block 1004, an network administrator selection of one of thedisplayed problem event representations is received. Such a selectioncan occur using any graphical selection device such as a mouse,trackball, light pen, keyboard and the like. In response to the networkadministrator selection received at block 1004, contextual diagnosticdata and instructions informing the network administrator how totroubleshoot the selected problem event is displayed at block 1006. Inaddition, at block 1008 diagnostic data pertinent to troubleshooting theparticular problem event is displayed. Such diagnostic data is retrievedfrom or generated by relevant entities in network system 100.

[0114] In one embodiment, included in the display of suchcontext-sensitive instructions and diagnostic data, graphical displayelements representing the pathway to additional, more detailedinformation is provided. Any type of graphical display element such ashyperlinks, buttons, menus, icons and the like can be displayed. In suchembodiments, receipt of an network administrator graphical selection ofonce such graphical display element is received at block 1010. Inresponse, at block 1012, the information represented by the selecteddisplay element is displayed. If the selected display element appearedin association with a troubleshooting instruction, the additionalinformation may include, for example, an explanation of why thattroubleshooting step is to be performed, low-level steps that can betaken to perform the troubleshooting step, etc. If the selected displayelement appeared in association with diagnostic data, the additionalinformation may include, for example, more detailed diagnostic data.

[0115] The network administrator can then view the context-sensitivetroubleshooting instructions and diagnostic data and follow theprocedures offered to rectify the selected problem event. Thus, thisgraphical display process guides the network administrator through thetroubleshooting process, facilitating the efficient identification andcorrection of the cause of the event.

IV. Examples

[0116] Two examples of TS profile 205 of the present invention will nowbe described with reference to a corresponding troubleshooting viewwindow displayed generated by the processing of the exemplarytroubleshooting (TS) profile.

[0117]FIG. 11 is an illustration of a graphical user interface displaywindow displayed by problem event GUI 210 to display a problem eventlist 213 generated by problem event processor 202. Event list displaywindow 1100 is titled “Alarms” 1102 and provides problem events 201listed according to category. In this illustrative example, the problemevents 201 associated with E-mail service are displayed. A subtitle line1104 is included in view window 1100 to identify the category of thedisplayed problem events 201. As shown in subtitle bar 1104, the numberof problem events (“19 Alarms”) is displayed.

[0118] For each problem event 201, three data values are provided inrow-adjacent manner. The first data value 1106 provides the time ofoccurrence of the problem event, the second data value 1108 provides thedevice of occurrence of the problem event, and a brief description.

[0119] Of the displayed problem events, the network administratorselects using a pointing device such as a computer mouse or othergraphical selection device the first problem event 201 in the displayedproblem event list 213. This selected problem event occurred at the node“mailserver6.acme.com” on Mar. 14, 2001, 12:11:08 AM MST. The problemevent is referred to as “Node down.” Th emphasis this selection in theFigure, the descriptor “Node down” is underlined.

[0120] In response to this problem event selection 215, problem eventprocessor 202 generates event data 203 that is processed bytroubleshooting profile manager 204 to categorize the problem event1112A and to load TS profile 205 associated with that categorization. Inthis exemplary embodiment, the troubleshooting category is entitled“Connectivity” and a resulting troubleshooting profile 1200 is populatedand provided in portal view manager 206 as populated TS profile 205.This TS profile, referred to herein as TS profile 1200, is displayed inFIGS. 12A-12F. The relationship between FIGS. 12A-12F is illustrated inFIG. 12. This particular TS profile 1200 is in XML format. FIGS. 13A-13Dare illustrations of different portions of a TS view window 1300generated by troubleshooting portal view manager 206 when implementingTS profile 1200. TS profile 1200 and TS view window 1300 will bedescribed in detail below. In FIGS. 13A-D there are a series of TS datawindows 1302 each presenting troubleshooting information for aparticular TS data miner module 608. TS profile 1200 and correspondingTS view window 1300 will now be described in detail.

[0121] Lines 1 and 2 of TS profile 1200 include standard headerinformation for an XML document, identifying the version and type ofdocument. The content and format are well known.

[0122] Lines 3-10 define attributes that apply to the entire TS viewwindow 1300. In this illustrative embodiment, these attributes areidentified by the element “PortalView” and include information such asthe color scheme (colorScheme=“/OvSipDocs/styles/default.css”) at line4, the view window identifier (defaultSheetlD=“Troubleshoot”) andrefresh rate (refreshRate=“3600”) at line 5. At lines 6 and 7 the date1304 and user name 1306 are set to appear. In view window 1300, thesevalues appear in the boarder 1308 of TS view window 1300. At lines 8 and9 the view window ID (Sheet id=“Troubleshoot”) is provided along withthe name “Connectivity Troubleshooting” (title=“ConnectivityTroubleshooting”) for display. In this illustrative embodiment, TS viewwindow 1300 is a tabbed window. The specified title is shown in the bodyof tab 1310 of TS view window 1300, as shown in FIG. 13A.

[0123] In the embodiment shown in FIG. 13, the troubleshootinginformation provided to the network administrator in accordance with thepresent invention is displayed in a two column format. This facilitatesthe condensed display of context-sensitive information in a single viewwindow. The attribute specified at line 10 establishes a column formatfor view window 1300, along with the width of the left column (Columnwidth=“narrow”). Referring to FIG. 13, this results in a TS view window1300 having a plurality of TS data windows 1302 arranged in two columns:a left column 1312 and a right column 1314. The selection of a narrowcolumn width for left column 1312 and a wider column width for rightcolumn 1314 facilitates the optimal use of display space introubleshooting view window 1300. Information that can be condensed orsummarized is located in left column 1312 while information that can notis located in right column 1314.

[0124] TS profile 1200 includes, as noted, portal view layoutinformation 502 and TS data miner module references 504. In theembodiments illustrated in FIG. 12, TS profile 1200 includes ten (10) TSmodule references 504, referred to as TS module references 1206A-1206J.As noted with reference to FIG. 5, each such TS module reference 504typically includes one or more configuration parameters 506 that specifythe functions to be performed by the referenced TS data miner module608.

[0125] Each TS module reference 1206 is segregated into a block of XMLcode. This block structure of XML code begins with a element“<ModuleInstance” and ends with the corresponding XML line of code“</Modulelnstance>.” There are a series of attributes included in“<ModuleInstance” that define this instance of the invoked TS module608. The attributes include a unique TS module identififier (“classid”)that uniquely identifies the referenced TS module 608. This is followedby one or more parameters that identify general as well as specificattributes including, for example, display formats, location of helpfiles, the identification of the managed object, problem event and theassociated domain manager 224. As one of ordinary skill in the art wouldfind apparent, these attributes can and will vary for different TSmodules 608. Included within each reference block 1206 there are one ormore configuration parameters 5096 that are passed to the referenced TSmodule 608 when that module is invoked. These configuration parameters506, as noted, specify the functions to be performed by the referencedTS data miner module 608, including but not limited to, the type andbreadth of troubleshooting information sought. This too will varydepending on the type of TS data miner module 608, type of problem eventand type of domain manager 224, among other factors. Specific examplesshown in XML TS profile 1200 will now be described.

[0126] The first TS module reference 1206A is provided at lines 11-19 ofTS profile 1200. The resulting TS data window 1302A displayed by portalview manager 206 in response to the processing of this block of code isshown in FIG. 13A as TS data window 1302A. This particular TS data minermodule 608 determines which services are impacted by the occurrence ofthe selected problem event 215.

[0127] The XML line of code at line 11 “<ModuleInstance” indicates thebeginning of this TS module reference block of code1206A. The uniqueidentifier for this particular TS data miner module 608 is provided atline 12 (classid=“com.hp.ov.portal.modules. service.SvcCardServlet”).The results will be displayed (display=“yes”). The next attribute is adisplay attribute (rollupState=“down”) indicating to GUI 212 how todisplay the troubleshooting data provided by the referenced TS module608, followed by an internal identifier for this instance of the dataminer (id=“my6”).

[0128] At line 14 a help file URL(help=“/OvSipDocs/C/help/SvcCard/cardView.htm”) is specified. Referringto FIG. 13A, a help button 1316A is provided on TS data window 1302A. Asimilar help button is also displayed in the other TS data windows 1302.The help file specified at line 14 is linked to help button 1316A byportal view manager 206. Such a help file can provide any desiredinformation to assist the network administrator with informationregarding the reference TS module 608 and resulting TS data display1302. Such a help display can include references or links to othersources of information. The title 1318A for this troubleshooting datawindow 1302A is Impacted Services, as specified on line 15(title=“Impacted Services”). As shown in FIG. 12A, these parameters thatspecify attributes for this instance of the invoked TS module 608 arepresented with the Module Instance reference within opening and closingbrackets (<>).

[0129] The lines of code 16-18 are parameters that are passed to the TSdata miner module 608 identified in the classid (line 12). For this TSdata miner module 608, the parameters are bound by <ServiceCard . . . >and </ServiceCard> elements. This is a syntax expected by thisparticular TS module 608. Between these elements, the referenced TSmodule 608 is instructed not to retrieve detailed information(details=“no”) at line 16 and that the domain manager 224 in networksystem 100 that contains the requested information is bacchusn(server=“bacchusn”). The service of interest on the identified server;that is, the service for which the impact of the problem event 201 isdesired, is the email service (ServiceRef name=“email”). Referring toFIG. 13A, Impacted Services data window 1302A is shown at the top ofleft column 1312. TS module 608 returned TS data 207 indicating that theimpacted service is the E-Mail service located on the corporateelectronic mail server (mailserver6.acme.com), and that the impact(“Status”) is minor.

[0130] The next TS module reference 1206B invokes a TS data miner module608 that determines the customers that may be impacted by a selectedproblem event 215. This TS module reference 1206B includes lines 20-39of TS profile 1200, as illustrated in FIGS. 12A and 12B. The moduleinstance attributes parameters are similar to those noted above inconnection with TS module reference 1206A. These include the unique dataminer (classid=“com.hp.ov.portal.modules.ovgeneric”), that the resultsare to be displayed (display=“yes”), the location of the correspondinghelp file (help=“/OvSipDocs/C/help/examples/integ.html”), the internalinstance identifier (id=“Generic100”), the display window displayelement (rollupState=“down”) and the title to be displayed on thetroubleshooting display window (title=“Impacted Customers”). Referringto FIG. 13A, the resulting TS data window 1302B generated by portal viewmanager 206 is shown in left column 1312.

[0131] The syntax required by this TS module 608 include the module(<Generic> and </Generic>) and sub-module (<Submodule> and </Submodule>)elements. The customer data accessed by this TS module 608 iscategorized in relative terms based on predetermined characteristics ofeach customer. In this example, of the number of categories that can beestablished, the identification of customers that fall into twocategories, “Gold” and “Silver” customers, each requested in a separatesub-module. For each sub-module, a title bar is identified (<TitleBartitle=“Gold Customers”/> at line 28 and <TitleBar title=“SilverCustomers”/> at line 33). Referring to FIG. 13A, the two categories ofinformation are identified by partitioning data window 1302B into tworegions 1320A and 1320B, one with a title bar “Gold Customers”, theother with a title bar “Silver Customers”, as specified in TS profile1200. The location of the information sought is identified for eachsub-module (for gold customers, <EmbeddedHtmldata=“&lt;strong&gt;VIC1&lt;/strong&gt;”/> at lines 29 and 30; forsilver,<EmbeddedHtmldata=“&1t;strong&gt;Cust1&1t;br&gt;Cust4&lt;br&gt;Cust6&lt;/strong&gt;”/> at lines 35 and 36 of TS profile 1200. Referring to FIG. 13A,the referenced TS module 608 returns troubleshooting data 207 indicatingthat one Gold customer, VIC1, and three silver customers, Cust1, Cust4and Cust5) are impacted by the occurrence of the selected problem event215.

[0132] The next TS module reference 1206C invokes a TS data miner module608 that retrieves data related to specified internet services andpresents them in a graphical format. This TS module reference 1206Cincludes lines 40-52 of TS profile 1200, as illustrated in FIG. 12B.

[0133] The module instance attributes are similar to those noted aboveand are not described further here. Referring to FIG. 13A, the TS datawindow 1302 for this TS data miner module 608 is Internet Services datawindow 1302C located in left column 1312.

[0134] The parameters that are passed to the referenced TS data minermodule 608 are bounded by <VPIS . . . > and </VPIS> elements. As withthe other TS module references 1206A and 1206B, this is the syntaxspecified by the referenced TS module 608. The first attribute withinthis block of parameters identifies the number of days of data to obtainwhen generating the requested information (days=“30”), and the timeinterval between successive data points (hours=“1”). Of the availableinternet service performance characteristics that can be analyzed,reports for two such internet service characteristics are requested. Theavailability of the service (ServiceType availability=“yes”) and thepercentage of service violations that have occurred, referred to as SLOCompliance (serviceLevelViolations=“yes”) were requested. The otheravailable internet service performance characteristics were notrequested. These include service availability (availabilityReport=“no”),the response time of the internet service (responseTime=“no”) and itsdetails (ResponseTimeComponents=“no”). In addition, the generation of areport that identifies the violations that occurred at each level ofservice (ServiceLevelViolationsReport=“no”) was not requested. Alsoincluded in these parameters is the aspect of the email service to beanalyzed. Here, the protocol used by email servers to communicate withthe email interface on individual machines, IMAP-4 is specified(name=“IMAP4-Email Service”).

[0135] Referring to FIG. 13A, Internet Services data window 1302C isshown. The title of window 1302C is “Internet Services” in accordancewith the specified module instance attributes. There is also a text boxin which the network administrator can enter the time interval for thespecified data. As noted, this enables the network administrator tomodify the parameters set forth in a TS profile 205 should the defaultvalues not provide the insight desired. The entered specification datais generated by GUI 212 as part of network administrator TS commands221.

[0136] In TS display window 1302C the field is entitled “Change TimeInterval”, and can be used by the network administrator to change thedefault value of 30 days to another time period. In this example, thenetwork administrator changed the time period to 8 hours.

[0137] Below this information, portal view manager 206 displays theaspect of the service that was analyzed and the period of time overwhich the displayed data occurred (“Summary: IMAP4—Email Service Last 8Hours”). Since two characteristics of this service were requested, twogauges are displayed with their relevant titles. In addition, a numericdisplay is also provided.

[0138] The next TS module reference 1206D invokes a TS data miner module608 that accesses a number of databases on network system 100 todetermine the health of the underlying network system 100. This TSmodule reference 1206D includes lines 53-74 of TS profile 1200, asillustrated in FIGS. 12B and 12C. The module instance attributesparameters are similar to those noted above in connection with TS modulereference 1206A. These include the unique data miner(classid=“com.hp.ov.portal. modules.health”), that the results are to bedisplayed (display=“yes”), the location of the corresponding help file(help=“/OvSipDocs/C/help/nmHealth/healthView.html”), the internalinstance identifier (id=“module25”), the display window display element(rollupState=“down”) and the title to be displayed on thetroubleshooting display window (title=“Network Health”). Referring toFIG. 13B, the resulting TS data window 1302D generated by portal viewmanager 206 is shown in left column 1312.

[0139] The lines of code 59-69 are parameters that are passed to thereferenced TS data miner module 608 identified in the classid (line 54).For this TS data miner module 608, the parameters include a request thatdetailed information pertaining to network health determination not beprovided (NetworkHealth showRawData=“no”). Also, there are some devicesthat have an unknown state. In this example, such devices are notincluded in the health determination (showUnknown=“no”). A summaryformat for the display is requested (Summary display=“yes”) in which thelevel of data to be displayed is at a level 3 of 5 levels(displayDepth=“3”). The managed object which experienced the selectedproblem event 215 is provided. Here, problem event 215 is a network nodethat is not responding. Accordingly, the managed object title is thenode ID appended by the work “health” (title=“mailserver6.acme.comHealth”).

[0140] TS profile 1200 also specifies which aspects of the system aregoing to be considered in rendering this health determination, alongwith how the specified aspects are to be weighted relative to eachother. In this example, a single aspect to be considered in determiningthe health of the network is the health of the network interface(Component href=“#IfHealth” vital=“no” weight=“1”). It should beappreciated that each such component corresponds with an SNMP variable,of which there are thousands, and that any number and combination ofcomponents can be specified to contribute to the health determination.

[0141] Referring to FIG. 13B, troubleshooting data window 1302D has atitle of “Network Health” in accordance with the module instanceattribute specifications. The next line in display window 1302D is thetitle specified at line 62 of TS profile 1200, “mailserver6.acme.comHealth”. A single gauge and associated numerical display is shownindicting that the overall health of the specified system, as reflectedin the selected component(s), is 33%.

[0142] The parameters can include an indication of which objects toconsider when determining the overall health. To shown the health of allservers including the specific managed object, a node selectionparameter can be included (<NodeSelection id=“Servers” op=“AND”title=“Servers”>). In addition, certain information can be filtered.Here, nodes that include the specified managed object and the servercoleman.cnd.hp.com are considered (<IPHostFilter op=“OR”>; <IPHosthostname=“coleman.cnd.hp.com”/>). It should be appreciated that nayselected data can be displayed in any graphic format.

[0143] The next TS module reference 1206E invokes a TS data miner module608 that references predetermined report generators located on domainmanagers 224. This TS module reference 1206E includes lines 75-94 of TSprofile 1200, as illustrated in FIG. 12C. The module instance attributesparameters are similar to those noted above in connection with other TSmodule references 1206. These include the unique data miner(classid=“com.hp.ov.portal.modules.bookmarks”), that the results are tobe displayed (display=“yes”), the location of the corresponding helpfile (help=“/OvSipDocs/C/help/bookMark/bookmkView.html”), the internalinstance identifier (id=“my1450”), the display window display element(rollupState=“down”) and the title to be displayed on thetroubleshooting display window 1302 (title=“Reports”). Referring to FIG.13B, the resulting TS data window 1302E generated by portal view manager206 is shown in left column 1312.

[0144] After the element indicating the beginning of a list of reports(<Bookmarks>), the referenced TS data miner module 608 provides the URLfor each of three report generators each identified with the syntax“<Entry . . . />”. Within each entry there is a URL to the reportgenerator, a location to send the report, and the title of the displayedlink to the URL. For example, selection of the link 1322A, entitled“Services” per line 84 of TS profile 1200, invokes a report generator(“http://sushi.bbn.hp.com/OvSipDocs/C/reports/ito_service-history_yesterday/default.htm”) provided at lines82 and 83 of TS profile 1200 that provides a separate view with detailedinformation regarding the services relevant to problem event 215.Similar report generators are specified at lines 86-87 and 90-91 of TSprofile 1200, entitled “Availability” 1322B and “Performance” 1314C perlines 88 and 92, respectively, of TS profile 1200.

[0145] When invoked by the network administrator, each report generatorgenerates a report that can provide a large quantity of detailedinformation in a separate display window. Thus, a TS profile 403 caninclude certain such report generator URLs that are relevant to theselected problem event 215 and the troubleshooting process to diagnoseand correct the cause of such a problem event.

[0146] At line 95 of TS profile 1200 there is a column element. Thiscauses troubleshooting portal view manager 206 to advance the display ofthe subsequent display windows 1302 in a next column. Accordingly, theReports display window 1302E is the last display window of left column1312 in troubleshooting view window 1300. The next column, right column1314 is specified in line 96 of TS profile 1200 as being presented in awide format.

[0147] The next TS module reference 1206F invokes a TS data miner module608 that retrieves problem event data. This TS module reference 1206Fincludes lines 97-121 of TS profile 1200, as illustrated in FIGS. 12Cand 12D. The module instance title is “Event Information” as shown indisplay window 1302F illustrated in FIG. 13A. The remainder of themodule instance definition is similar to those described above.

[0148] The syntax required by this TS module 608 include the module(<Generic> and </Generic>) and sub-module (<Submodule> and </Submodule>)elements. Each sub-module generates TS data 207 that is displayed in apredetermined region of the corresponding TS display window 1302F.

[0149] This TS module reference 1202F includes three sub-modules, eachof which sets forth parameters to be passed to the referenced TS dataminer module 608. This specific TS module 608 performs a combination ofdata mining operations, as evidenced from the TS data 207 and TSinstructions 209 displayed in TS data window 1302F. Each set ofparameters specifies a sub-title and corresponding data that isultimately displayed in a portion of display window 1302F.

[0150] The first sub-module extends from lines 102-107. The passedparameters specify the title to be displayed at line 103 (TitleBartitle=“Event Details”), as shown by title 1324A in display window 1302F.The format of the displayed event data is to be either text or HTML(type=“text/html”) and stored in the designated file(fileName=“$SIP_HOME_DIRconf/share/events/detailsA”). The informationshown in region 1326A of window 1302F is stored in the designate fileand displayed to the network administrator as shown in FIG. 13A. Theevent details displayed include, in this example, the name of theproblem event, the severity of the impact of the occurrence of theproblem event, the identification of the managed object, here a networknode, the associated event category specified by, perhaps, theresponsible domain manager 224, and the specific event and messageidentifiers.

[0151] The next sub-module is provided at lines 108-113 and specifiesthat the retrieved description of the problem event have an associatedsubtitle “Event Description”, as specified at line 109. The text/htmloutput is stored in the file(fileName=“$SIP_HOME_DIRconf/share/events/descriptionA”) designated atlines 111-112, and displayed in region 1326B of data display window1302F. The TS module 608 specified at lines 98-99 may retrieve thisinformation from the same or different location than the TS data 207displayed in region 1322A. Referring to FIG. 13A, the displayed eventdescription is a natural language description of the problem event 215identified in region 1326A.

[0152] The final sub-module is provided at lines 114-119 of TS profile1200, causing the TS module 608 to provide instructions to the networkadministrator for troubleshooting this problem event. The passedparameters specify the subtitle “Event Instructions” 1324C at line 115,and the storage of the retrieved instructions at a file(fileName=“$SIP_HOME_DIRconf/share/events/ instructionsA”) specified atline 117-118. These event instructions can be retrieved from the same ordifferent location as the other information presented in window 1302F.This TS instructions 209 are displayed in region 1326C of TS datadisplay window 1302F.

[0153] The next TS module reference 1206G invokes a TS data miner module608 that causes the execution of two system utilities or tools 610. ThisTS module reference 1206G includes lines 122-140 of TS profile 1200, asillustrated in FIGS. 12D and 12E. The module instance attributesparameters are similar to those noted above in connection with other TSmodule references. The module instance is defined at lines 122-125,identifying the data miner 608 and specifying the title 1328 to be“Tools.” This is illustrated in FIG. 13B by the term “Tools” appearingin the title bar of window 1302G. Referring to FIG. 13B, the resultingTS data window 1302G generated by portal view manager 206 is shown inright column 1314.

[0154] The lines of code 126-139 are parameters that are passed to thereferenced TS data miner module 608 identified in the classid (line123). For this TS data miner module 608, the parameters are embedded inthe syntax noted above, module (<Generic> and </Generic>) and sub-module(<Submodule> and </Submodule>) elements, with each such sub-moduleinvoking and displaying a different system utility. Each sub-modulegenerates TS data 207 that is displayed in a predetermined region 1332of the corresponding TS display window 1302G.

[0155] The two utilities/tools are ping and traceroute, both of whichare well known in the network art. The parameters set forth in the firstsubmodule specify the Ping system tool 610 at line 130(fileName=“$SIP_HOME_DIRconf/share/events/ping”) and, at line 128, thatthe information is to be displayed in association with a subtitle “Ping”(TitleBar title=“Ping”). A common protocol for network performancemonitoring and troubleshooting is ICMP (Internet Control MessageProtocol). ICMP supports ping an echo messages, which are round-tripmessages to a particular addressed network device and then back to theoriginator. By issuing a ping to a network device, the networkadministrator can determine whether the network device is online oroffline on the basis of whether the ping message is returned to themanager. Because the ICMP protocol or other ping messages areuniversally supported, the network administrator can determine thesignificant status information for a network device. The ping utilityqueries the designated server and returns information regarding thestatus of the test communication as specified by the remainingparameters at lines 128-131. The results of the ping utility aredisplayed in region 1332A in accordance with the passed parameters. Thesecond sub-module is defined at lines 133- 138 is similar in format andstructure. The results of the traceroute utility are displayed in region1332B in accordance with the passed parameters.

[0156] The next TS module reference 1206H invokes a TS data miner module608 that retrieves alarm data. This TS module reference 1206H includeslines 141-150 of TS profile 1200, as illustrated in FIG. 12E. Referringto FIG. 13B, the resulting TS data window 1302H generated by portal viewmanager 206 is shown in right column 1314. The module instanceattributes parameters are similar to those noted above in connectionwith other TS module references. The module instance is defined at lines151-155, identifying the TS data miner module 608 and specifying thetitle 1328 to be “Recent Alarms.” This is illustrated in FIG. 13B by theterm “Recent Alarms” appearing in the title bar 1334 of window 1302H.

[0157] The referenced TS module608(classid=“com.hp.ov.portal.modules.alarms”) generates a request toevent consolidator 302 to provide all recent alarms generated by themanaged object, here node mailserver6.xml (CategoryDefNamehref=“mailserver6.xml”). This alarm information is displayed in TS datawindow 1302H under the specified title “Recent Alarms”. As showntherein, the noted node is identified as the source of all 19 alarms ina sub-header 1336.

[0158] The next TS module reference 12061 invokes a TS data miner module608 that that generates a topology map in accordance with the specifiedparameters. This TS module reference 1206I includes lines 151-163 of TSprofile 1200, as illustrated in FIG. 12E. Referring to FIG. 13C, theresulting TS data window 13021 generated by portal view manager 206 isshown in right column 1314.

[0159] Here, the passed parameters include a instruction not to providelower level details of the topology map (TopologyMap drillDown=“no”), toshow the status of the displayed nodes (showStatus=“yes”), and to thespecified portion of the show 3 levels of branches (Submaphref=“ovw:/islandia.cnd.hp.com/default/15.2.112.Segment3”) with the nodethat experienced problem event at the center of the topology map (Submapobject=“mailserver6.xml”). Referring to FIG. 13C, the resulting displaywindow 1302I is illustrated.

[0160] As noted, the network administrator can also receive anindication of a problem event directly from a customer on network system100. Such a customer may call or email the network administrator andprovide a description of the problem event. The network administratorenters this information into problem GUI 210 which provides it toproblem event processor 202 as a manual problem event 211. Thisinformation is then stored in problem event list 213 along with problemevents 201. These manually entered problem events are referred to as“Trouble Tickets” in this illustrative embodiment.

[0161] The next TS module reference 1206J invokes a TS data miner module608 that retrieves relevant Trouble Tickets from event processor 202.This TS module reference 1206J includes lines 164-176 of TS profile1200, as illustrated in FIGS. 12E and 12F. Referring to FIG. 13C, theresulting TS data window 1302J generated by portal view manager 206 isshown in right column 1314.

[0162] The title of this display window 1302J is “Service Desk” as shownin the title bar 1338 and specified at line 167 of TS profile 1200. The“<Generic>” and “<Submodule>” syntax is included, with each sub-moduleproviding parameters directed to the retrieval of certain relatedproblem events. In this particular embodiment, Trouble Tickets relatedto the specified problem event 215 are retrieved and displayed.Referring to FIG. 13C, the sub-title bar 1340 is titled “TroubleTickets” as specified by the parameter at line 170. The retrievedproblem events are displayed in accordance with the parameters at lines171-173. There, the display file information is not included (FiledisplayFileInfo=“no”) and the name of the file from which to retrievethe Trouble Ticket (fileName=“$SIP_HOME_DIRconf/share/events/ticketA”)is specified. The text/html documentation is provided with stripping theHTML header (stripHtmlHeader=“no”; type=“text/html”).

[0163] Referring to FIG. 13C, the information relevant to the specifiedtrouble ticket is displayed. This information includes the service callidentifier, the status of the problem event, when it was created. Otherinformation includes the priority assigned by the network administratorand the deadline by which the problem event is to be corrected. Otherinformation related to correcting the problem is also included such as adescription of the problem event, related information, the solutionproposed and workaround approach should the problem event persist.

[0164] At lines 177 and 178 the column element indicates that the secondcolumn is and the default framework for the portal view layout iscompleted.

[0165]FIG. 14 is an illustration of a graphical user interface displaywindow displayed by problem event GUI 210 to display a problem eventlist 213 generated by problem event processor 202. Event list displaywindow 1400 is titled “Alarms” 1402 and provides problem events 201listed according to category. In this illustrative example, the problemevents 201 associated with the web service are displayed. A subtitleline 1404 is included in view window 1400 to identify the category ofthe displayed problem events 201. As shown in subtitle bar 1404, thenumber of problem events (“52 Alarms”) is displayed in addition to thecategory identifier (“Web Service”).

[0166] For each problem event 201, the three data values noted abovewith reference to FIG. 11 are provided in row-adjacent manner. Of thedisplayed problem events, the network administrator selects the firstproblem event 1406 in the displayed problem event list 213. Thisselected problem event occurred at the node “webserver4.acme.com” onMar. 14, 2001, 07:17:11PM MST. The problem event is referred to as “Webserver response time SLO violation.”

[0167] In response to this problem event selection 215, TS profile 1500illustrated in FIGS. 15A-15F is implemented; that is, TS profile 1500 ispopulated and provided to portal view manager 206 as populated TSprofile 205. The relationship between FIGS. 15A-15F is illustrated inFIG. 15. This particular TS profile 1500 is in XML format. FIGS. 16A-16Eare illustrations of different portions of a TS view window 1600generated by troubleshooting portal view manager 206 when implementingTS profile 1500. TS profile 1500 and TS view window 1600 are similar toTS profile 1200 and TS view window 1300 described in detail below and,based on the disclosure thereof, should be understood by those ofordinary skill in the relevant art.

[0168] Further features of the invention are described in commonly-ownedU.S. Patent Application entitled “A PORTAL SYSTEM AND METHOD FORMANAGING RESOURCES IN A NETWORKED COMPUTING ENVIRONMENT”, filed on Apr.30, 2001 under Attorney Docket No. 10992434-1, and U.S. PatentApplication entitled “SYSTEM AND METHOD FOR MANAGING DATA MINER MODULESIN AN INFORMATION NETWORK SYSTEM”, filed on Apr. 30, 2001 under AttorneyDocket No. 10015949-1, the specifications of which are herebyincorporated by reference herein in their entirety.

IV. Closing

[0169] While various embodiments of the present invention have beendescribed above, it should be understood that they have been presentedby way of example only, and not limitation. For example, there is atroubleshooting profile 205 that corresponds with each type of problemevent 201. In alternative embodiments, the association betweentroubleshooting profiles 205 and problem events 201 can take on anyarrangement. For example, there may be a one-to-one correspondence. Asanother example, the troubleshooting data miner modules are referencedin troubleshooting profiles 205. In alternative embodiments,troubleshooting profiles 205 can include the functionality; that is, thecode, included in the referenced troubleshooting data miner modules.However, such an embodiment would result in some redundancy and,therefore, is not preferred over the disclosed embodiment. Anotherexample is the form in which data is stored. In the exemplaryembodiment, LUTs and databases are utilized. It should be understoodthat any type of data repository can be utilized. Similarly, thetransfer of information between components of the invention as well asbetween the invention and external entities can be accomplished throughany well known technique. For example, individual signals over data andcontrol lines, data buses over which encoded information, sharedlibraries, and the like can be used to transfer information. Inaddition, the computer programs noted above may exist in a variety offorms both active and inactive. For example, the computer programs canexist as application-level software program(s) comprised of programinstructions in source code, object code, executable code or otherformats; firmware program(s); or hardware description language (HDL)files. Any of the above can be embodied on a computer readable medium,which include storage devices and signals, in compressed or uncompressedform. Exemplary computer readable storage devices include conventionalcomputer system RAM (random access memory), ROM (read-only memory),EPROM (erasable, programmable ROM), EEPROM (electrically erasable,programmable ROM), and magnetic or optical disks or tapes. Exemplarycomputer readable signals, whether modulated using a carrier or not, aresignals that a computer system hosting or running the present inventioncan be configured to access, including signals downloaded through theInternet or other networks. Concrete examples of the foregoing includedistribution of executable software program(s) of the computer programon a CD ROM or via Internet download. In a sense, the Internet itself,as an abstract entity, is a computer readable medium. The same is trueof computer networks in general. It should also be understood that themethods described above are exemplary only, and that the operations,processes and steps of the method may be performed in a different orderthan illustrated or may be performed concurrently to the extent possiblegiven data limitations. Thus, the breadth and the scope of the presentinvention are not limited by any of the above exemplary embodiments, butare defined only in accordance with the following claims and theirequivalents.

What is claimed is:
 1. A troubleshooting mentor system for automaticallyproviding an administrator of a computing environment with diagnosticdata and instructions to troubleshoot a selected problem event occurringin the computing environment, wherein said diagnostic data andinstructions are specifically designed to provide the information andtechniques necessary to enable a administrator troubleshoot the selectedproblem event.
 2. The troubleshooting mentor system of claim 1, whereinupon selection of said selected problem event, said troubleshootingmentor system automatically retrieves from relevant computingenvironment entities said diagnostic data.
 3. The troubleshooting mentorsystem of claim 1, wherein said selected problem event is one of aplurality of problem events generated by domain managers in thecomputing environment, each said domain manager managing an entity onthe computing environment.
 4. The troubleshooting mentor system of claim1, wherein said troubleshooting mentor system comprises: a problem eventprocessor that causes a display of said plurality of problem events thathave occurred, and that determines which of a plurality of atroubleshooting types corresponds to said selected problem event; atroubleshooting profile manager that executes a predeterminedtroubleshooting profile associated with said troubleshooting type ofsaid selected problem event; and a troubleshooting portal view managerthat executes said retrieved troubleshooting profile and one or moretroubleshooting data miner modules referenced in said retrievedtroubleshooting profile, each said troubleshooting data miner modulegenerating or causing the generation of said diagnostic data and saidinstructions, wherein said profile manager displays said diagnostic datagenerated by said referenced one or more troubleshooting data minermodules.
 5. The troubleshooting mentor system of claim 4, wherein saiddata miner modules include a first data miner module that generates orcauses the generation of said troubleshooting instructions, and whereinsaid troubleshooting portal view manager displays said troubleshootinginstructions produced by the execution of said first data miner module.6. The troubleshooting mentor system of claim 3, wherein said computingenvironment includes a network system, and wherein said domain managerscomprise one or more of the group consisting of: network managers thatmanage individual and collections of networks; software applicationmanagers that manage software applications executing on a node or serverof the computing environment; database managers that manage databasesexecuting on a node or server of the network system; and server managersthat assist a network administrator manage the operations of each serverin a network
 7. The troubleshooting mentor system of claim 3, whereinsaid problem event processor normalizes said plurality of problem eventsfor display.
 8. The troubleshooting mentor system of claim 3, whereinsaid event-type-specific information is displayed in accordance withviewpoint layout information included in said selected troubleshootingprofile.
 9. The troubleshooting mentor system of claim 1, wherein saidproblem events comprise: problem events automatically-generated by saiddomain managers; and problem events identified by a user of thecomputing environment and manually entered into the troubleshootingmentor system.
 10. The troubleshooting mentor system of claim 1, whereinsaid display of said diagnostic data can be modified by theadministrator inputs specifying a change in said diagnostic data, andwherein said troubleshooting portal view manager accesses said domainmanagers as necessary to obtain or cause the generation of said modifieddiagnostic data.
 11. The troubleshooting mentor system of claim 1,wherein said problem event processor generates event data associatedwith said selected problem event, said event data including an originalevent ID generated by the domain manager, said troubleshooting type ofsaid selected problem event, and information pertaining to the sourceentity that caused the generation of said problem event.
 12. Thetroubleshooting mentor system of claim 1, wherein said problem eventprocessor comprises: an event consolidator that receives problem eventsfrom domain managers, said problem events generated by different domainmanagers having different formats, said event consolidator processessaid problem events and, in response to each received problem event,generates a normalized event identifier having a standard format; and anevent type determinator that categorizes received problem events asbeing one of a plurality of troubleshooting types, each saidtroubleshooting type indicating diagnostic data and troubleshootingprocedures likely to be required to be performed or analyzed tosuccessfully troubleshoot each said problem event, and which generatessaid troubleshooting type for said selected problem event.
 13. Thetroubleshooting mentor system of claim 1, wherein said problem eventprocessor comprises: an event consolidator that receives problem eventsfrom domain managers and that generates a representation of the selectedproblem event, said representation including said troubleshooting type.14. The troubleshooting mentor system of claim 4, wherein saidtroubleshooting profile manager comprises: a repository oftroubleshooting profiles each associated with a particulartroubleshooting type of problem event; a repository of mapping data thatassociates each said troubleshooting type and one of saidtroubleshooting profiles; a profile selector that, based on saidtroubleshooting type of said selected problem event, retrieves from saidrepository one of said troubleshooting profiles that is to beimplemented for said selected problem event; and a profile conditionerthat populates said retrieved troubleshooting profile with at least aportion of said event data.
 15. The troubleshooting mentor system ofclaim 4, wherein said troubleshooting profile is an extensible,executable software program that invokes a predetermined combination ofdata miners that generate or cause the generation of context-sensitivetroubleshooting data and instructions to assist the administratordiagnose and correct the cause of said selected problem event.
 16. Thetroubleshooting mentor system of claim 14, wherein said repository ofmapping data is a look-up-table.
 17. The troubleshooting mentor systemof claim 14, wherein said troubleshooting profile manager furthercomprises: a troubleshooting profile editor that enables theadministrator to modify, add or delete the contents of said mapping dataand said database of said troubleshooting profiles.
 18. Thetroubleshooting mentor system of claim 14, wherein each saidtroubleshooting profile comprises: portal view layout information foruse by troubleshooting portal view manager and troubleshooting GUI inthe generation of a TS view window; one or more references totroubleshooting data miner modules that are to be utilized to obtaindiagnostic data and instructions relevant to troubleshooting selectedproblem event; and troubleshooting data miner module configurationinformation parameters that provide requisite information to said one ormore referenced troubleshooting data miner modules.
 19. Thetroubleshooting mentor system of claim 4, wherein said troubleshootingportal view manager comprises: a database of said troubleshooting dataminer modules; a data miner manager that invokes said one or moretroubleshooting data miner modules referenced in said troubleshootingprofile; and a portal view window generator that displays saiddiagnostic data and said troubleshooting instructions generated by saidreferenced data miner modules in accordance with said portal view layoutinformation contained within said troubleshooting profile.
 20. Thetroubleshooting mentor system of claim 19, wherein said troubleshootingdata miner modules are executable software programs that, when executed,access, call, query, or otherwise interface with external entities toretrieve or cause the generation of diagnostic data and troubleshootinginstructions.
 21. The troubleshooting mentor system of claim 4, whereinsaid troubleshooting data miner modules comprise one or more of thegroup consisting of: software programs that mine data from the databaseof one or more domain managers; software programs that access knowledgedatabases provided by a customer of the computing environment; andsoftware programs that call or invoke system utilities and tools that,when executed, generate said diagnostic data.
 22. The troubleshootingmentor system of claim 4, wherein said computing environment comprises adistributed network system.
 23. An apparatus that displayscontext-sensitive troubleshooting information relevant to the diagnosisof a particular problem event occurring a computing environment, whereinsaid troubleshooting information includes instructions fortroubleshooting said particular problem event, and wherein saidcontext-sensitive troubleshooting information is generated automaticallyand without network administrator action subsequent to identifying saidparticular problem event.
 24. The apparatus of claim 23, wherein saidcontext-sensitive troubleshooting information relevant to saidparticular problem event includes diagnostic data for assisting anetwork administrator in diagnosing said particular problem event. 25.The apparatus of claim 24, wherein said diagnostic data is retrievedautomatically from a management device that manages one or more networkentities.
 26. The apparatus of claim 24, comprising: a database oftroubleshooting data miner modules each generating or causing thegeneration of one of either troubleshooting instructions and diagnosticdata; a repository of troubleshooting profiles each referencing one ormore data miner modules that result in the generation of troubleshootinginstructions and diagnostic data for a particular type of problem event;a memory device in which is stored data that associates each saidproblem event type with a troubleshooting profile; and a troubleshootingsoftware module that displays problem events received from domainmanagers and that determines said type of a problem event selected by anadministrator, retrieving a troubleshooting profile from said repositorythat is associated with said type and executing same to cause theinvocation of said referenced troubleshooting data miner modules,displaying said diagnostic data and troubleshooting instructionsgenerated by said referenced troubleshooting data miner modules.
 27. Amethod for displaying context-sensitive information relevant to aparticular problem event occurring in an entity of a computingenvironment, comprising: A) receiving a selected problem event; B)generating contextual instructions and diagnostic data pertinent totroubleshooting the particular problem event; and C) displaying saidinstructions and said diagnostic data on a display device.
 28. Themethod of claim 27, wherein receiving a selected problem eventcomprises: 1) receiving a plurality of problem events each generated bya domain manager residing in the computing environment; 2) storing saidreceived problem events in a repository of problem events that haveoccurred in the computing environment; 3) displaying said plurality ofstored problem events in an interactive display; 4) receiving an networkadministrator selection of one of the displayed problem events; and 5)generating an output indicating which of said plurality of problemevents is said selected problem event.
 29. The method of claim 27,wherein generating contextual diagnostic data pertinent totroubleshooting the particular problem event comprises: 1) determiningwhich type of problem event is said selected problem event; and 2)determining which troubleshooting diagnostic data and instructions todisplay based on said type of said selected problem event.
 30. Themethod of claim 29, wherein determining which troubleshooting diagnosticdata to display comprises: a) providing a database of troubleshootingdata miner modules, each said troubleshooting data miner modulegenerating or causing the generation of diagnostic data or instructionsrelated to a particular network entity or function; b) generating adatabase of troubleshooting profiles each referencing a predeterminedone or more troubleshooting data miner module to display diagnostic dataand troubleshooting instructions pertinent to a particular type ofproblem event; c) retrieving from said database of troubleshootingprofiles a troubleshooting profile associated with said type of saidselected problem event; and d) invoking said retrieved troubleshootingprofile and said one or more troubleshooting data miner modulesreferenced therein.
 31. A method for displaying context-sensitiveinformation relevant to a particular problem event occurring in anentity of a computing environment, comprising: A) displaying arepresentation of a plurality of problem events that have occurred incomputing environment; B) receiving an network administrator selectionof one of the displayed problem event representations; and C)displaying, in response to said network administrator selection,diagnostic data pertinent to troubleshooting said selected problem eventand instructions informing the network administrator how to troubleshootsaid selected problem event.
 32. The method of claim 31, furthercomprising: D) displaying graphical display elements representingadditional, more detailed information; E) receiving an networkadministrator graphical selection of once such graphical displayelement; and F) displaying said addition, more detailed informationrepresented by said selected display element in response to said networkadministrator graphical selection.
 33. The method of claim 31, whereinwhen said selected display element appears in association with atroubleshooting instruction, said additional information includes one ormore of the group consisting of information describing the associatedtroubleshooting step, sub-steps that can be taken to perform thetroubleshooting step, references to external documentation pertaining tosaid troubleshooting step or network entities.
 34. The method of claim31, wherein when said selected display element appears in associationwith a diagnostic data, said additional information includes one or moreof the group consisting of additional, more detailed diagnostic data,instructions regarding how the diagnostic data is to be interpreted. 35.A computer program product comprising a computer readable medium havingcomputer program logic recorded thereon for enabling a processor in acomputer system to automatically display diagnostic data andinstructions on how to troubleshoot a selected problem event, whereinsaid diagnostic data and instructions are specifically relevant totroubleshooting said selected problem event.
 36. The computer programproduct of claim 35, wherein said computer readable medium comprises: adatabase of said troubleshooting data miner modules each generating orcausing the generation of one of either troubleshooting instructions anddiagnostic data; a repository of troubleshooting profiles eachreferencing one or more data miner modules that result in the generationof troubleshooting instructions and diagnostic data for a particulartype of problem event; and a memory device in which is stored data thatassociates each said problem event type with a troubleshooting profile;and wherein said computer program logic enables the processor to displayproblem events received from domain managers on the network and thatdetermines the type of a problem event selected by a user and retrievesa troubleshooting profile from said repository that is associated withsaid type, and that executes said retrieved troubleshooting profilecausing the invocation of said referenced troubleshooting data minermodules, displaying said diagnostic data and troubleshootinginstructions generated by said referenced troubleshooting data minermodules.
 37. A program storage device readable by a machine, tangiblyembodying a program of instructions executable by the machine to performmethod steps for displaying context-sensitive information relevant to aparticular problem event occurring in an entity of a computingenvironment, comprising: A) receiving a selected problem event; B)generating contextual instructions and diagnostic data pertinent totroubleshooting the particular problem event; and C) displaying saidinstructions and said diagnostic data on a display device.
 38. Theprogram storage device of claim 37, wherein receiving a selected problemevent comprises: 1) receiving a plurality of problem events eachgenerated by a domain manager residing in the computing environment; 2)storing said received problem events in a repository of problem eventsthat have occurred in the computing environment; 3) displaying saidplurality of stored problem events in an interactive display; 4)receiving an network administrator selection of one of the displayedproblem events; and 5) generating an output indicating which of saidplurality of problem events is said selected problem event.
 39. Theprogram storage device of claim 37, wherein generating contextualdiagnostic data pertinent to troubleshooting the particular problemevent comprises: 1) determining which type of problem event is saidselected problem event; and 2) determining which troubleshootingdiagnostic data and instructions to display based on said type of saidselected problem event.
 40. The program storage device of claim 39,wherein determining which troubleshooting diagnostic data to displaycomprises: a) providing a database of troubleshooting data minermodules, each said troubleshooting data miner module generating orcausing the generation of diagnostic data or instructions related to aparticular network entity or function; b) generating a database oftroubleshooting profiles each referencing a predetermined one or moretroubleshooting data miner module to display diagnostic data andtroubleshooting instructions pertinent to a particular type of problemevent; c) retrieving from said database of troubleshooting profiles atroubleshooting profile associated with said type of said selectedproblem event; and d) invoking said retrieved troubleshooting profileand said one or more troubleshooting data miner modules referencedtherein.